A digital signature (S.3) authenticates electronic records using asymmetric crypto system (public-private key pair). An electronic signature (S.3A, inserted 2008) is a broader, technology-neutral authentication method prescribed by the government. Both serve to verify the identity of the signatory and integrity of the record.
Legal Framework
| Provision | Subject |
|---|---|
| S.2(1)(p) | Definition: "digital signature" |
| S.2(1)(ta) | Definition: "electronic signature" (inserted 2008) |
| S.3 | Authentication of electronic records by digital signature |
| S.3A | Authentication by electronic signature (technology-neutral) |
| S.5 | Legal recognition of electronic signatures |
| S.14 | Secure electronic record (not altered since specific time) |
| S.15 | Secure electronic signature (verifiable, detects alteration) |
| S.16 | Security procedures prescribed by government |
| S.35 | Certifying Authority to issue Digital Signature Certificate |
| S.38 | Contents of DSC: identity, public key, serial number, validity |
| S.40-42 | Duties of subscribers |
| Second Schedule | Electronic signature/authentication techniques |
How Digital Signatures Work (Asymmetric Cryptography)
| Step | Process |
|---|---|
| 1. Key generation | Subscriber generates public key + private key pair |
| 2. Hash creation | Electronic record is passed through hash function producing fixed-length digest |
| 3. Signing | Hash is encrypted with signer's private key = digital signature |
| 4. Transmission | Electronic record + digital signature sent to recipient |
| 5. Verification | Recipient uses signer's public key to decrypt signature, recomputes hash, compares |
| 6. Validation | If hashes match: signature valid (authenticity + integrity confirmed) |
Why: Asymmetric cryptography ensures three properties: (1) Authentication (signer identified), (2) Integrity (record not altered post-signing), (3) Non-repudiation (signer cannot deny having signed).
Illustration: Digital Signature in Everyday Terms
Think of it like a wax seal on a letter in the old days:
- Private key = your personal seal stamp (only you have it)
- Public key = a photograph of your seal pattern (everyone can see it to verify)
- Signing = you stamp the letter with your seal (only you can do this)
- Verification = recipient compares the stamp on the letter against the photograph of your seal pattern. If they match, they know: (a) it came from you (authentication), (b) the letter was not opened and resealed (integrity), (c) you cannot deny sending it because only your stamp makes that pattern (non-repudiation)
In practice: When a CA files GST returns online, they use a USB token containing their private key. The portal verifies the signature using the corresponding public key from the DSC. If the return is altered after signing, the hash won't match and the signature fails verification.
Digital Signature vs. Electronic Signature
| Parameter | Digital Signature (S.3) | Electronic Signature (S.3A) |
|---|---|---|
| Inserted by | Original Act (2000) | 2008 Amendment |
| Technology | Asymmetric crypto (PKI) only | Technology-neutral (any technique notified by government) |
| Legal status | Specific, more secure | Broader, inclusive |
| Examples | DSC issued by licensed CA | Aadhaar e-Sign, biometric authentication, OTP-based |
| Governing standard | Asymmetric cryptosystem + hash function | As prescribed in Second Schedule |
| Certifying Authority required | Yes (licensed CA issues DSC) | May or may not need CA (depends on technique) |
| International alignment | X.509 standard | EU eIDAS-like technology neutrality |
Secure Electronic Record (S.14) and Secure Electronic Signature (S.15)
| Concept | Requirement | Effect |
|---|---|---|
| Secure electronic record | Security procedure applied; no alteration since specific point in time | Presumed unaltered (S.85 BSA) |
| Secure electronic signature | Applied at time of signing; can verify signer; detects post-signing alteration | Presumed valid signature |
| Security procedure | Commercially reasonable, agreed by parties, or government-prescribed | Standard for "secure" status |
Why: The distinction between ordinary and "secure" electronic records matters for evidentiary presumptions. A "secure" record carries statutory presumption of non-tampering; an ordinary record does not and must be independently proved.
Duties of Subscribers (S.40-42)
| Section | Duty |
|---|---|
| S.40 | Generate key pair using prescribed security procedure |
| S.40A | Ensure control of private key corresponding to public key in DSC |
| S.41 | Accept DSC issued by Certifying Authority |
| S.42(1) | Private key must not be disclosed to any person not authorized |
| S.42(2) | If private key compromised, notify Certifying Authority immediately |
| S.42(3) | Subscriber liable for unauthorized use until CA is notified |
Why: The entire PKI system rests on the assumption that the private key is known only to the subscriber. If the private key is compromised and the subscriber fails to notify the CA, third parties relying on the DSC will be defrauded, so liability shifts to the negligent subscriber.
Recall Check
- What three properties does a digital signature ensure?
- What is the key difference between S.3 and S.3A?
- When does a subscriber become liable for unauthorized use of their private key?
Key Cases
TCS v. State of Andhra Pradesh (2005) TCS-v-State-of-AP-2005 Issue: Whether electronically generated records and digitally signed documents have legal validity in government procurement. Rule: S.4 and S.5 IT Act give legal recognition to electronic records and digital signatures; government agencies must accept digitally signed tenders where prescribed. Held: Court upheld the legal validity of electronically submitted and digitally signed documents in government e-procurement process.
Trimex International v. Vedanta Aluminium (2010) Trimex-International-v-Vedanta-Aluminium-2010 Issue: Whether emails exchanged between parties constitute valid offer and acceptance for contract formation. Rule: Under S.4 (legal recognition), S.11 (attribution), and S.13 (dispatch/receipt), emails are electronic records with legal validity. Electronic communication can constitute valid contractual agreement. Held: Supreme Court held that a contract through email correspondence is valid and enforceable. The emails constituted a binding agreement between the parties.
Distinctions
| Aspect | Digital Signature Certificate (DSC) | Aadhaar e-Sign |
|---|---|---|
| Technology | PKI (asymmetric cryptography) | OTP + Aadhaar authentication |
| Validity period | 1-3 years (renewable) | Transaction-specific (one-time) |
| Key generation | Subscriber generates key pair | Centralized system generates |
| Hardware requirement | USB token / smart card | No hardware (online service) |
| Cost | Paid (Rs.500-2000/year) | Free or nominal |
| Security level | High (private key with subscriber only) | Medium (relies on Aadhaar OTP) |
| Use case | Filing returns, MCA compliance, e-tendering | Quick authentication, low-risk transactions |
| Legal basis | S.3 IT Act | S.3A IT Act (Second Schedule) |
Flashcards
Q: What does S.3 IT Act provide? A: Authentication of electronic record by digital signature: subscriber applies a hash function to the electronic record, then encrypts the hash with their private key.
Q: What is the difference between digital signature and electronic signature? A: Digital signature uses only asymmetric cryptography (S.3); electronic signature is technology-neutral and includes any technique notified by government (S.3A, 2008 Amendment).
Q: What three properties does a digital signature ensure? A: Authentication (identity of signer), integrity (record not altered), non-repudiation (signer cannot deny signing).
Q: What must a subscriber do if their private key is compromised (S.42)? A: Immediately notify the Certifying Authority. Subscriber is liable for any unauthorized use until notification.
Q: What is a "secure electronic signature" under S.15? A: One that: (a) is unique to subscriber, (b) capable of identifying subscriber, (c) created in manner under exclusive control of subscriber, (d) linked to electronic record such that any alteration is detectable.
Q: What is the hash function in digital signature context? A: A mathematical algorithm that converts variable-length data into a fixed-length digest (hash value), ensuring any change in original data produces a different hash.
Q: What does the Second Schedule of IT Act list? A: Electronic signature or authentication techniques recognized under S.3A (Aadhaar e-Sign is listed).
Q: What did Trimex International (2010) establish? A: Emails constitute valid electronic records; a contract formed through email correspondence is binding and enforceable under S.4, S.10A, S.11 IT Act.
Exam Scenario
A company submits a digitally signed tender for a government project. The government rejects it claiming only handwritten signatures are acceptable. The company challenges the rejection. Advise.
Under S.5 IT Act, where any law requires authentication by signature, such requirement is deemed satisfied by an electronic/digital signature. S.6 specifically enables electronic filing with government. TCS v. State of AP upholds validity of digitally signed documents in e-procurement. The government's rejection is legally unsustainable if: (1) the DSC is issued by a licensed Certifying Authority (S.35), (2) the certificate is valid and not revoked (S.38), (3) the subscriber complied with security procedures (S.40). If the government has not specifically excluded digital signatures through rules under S.10, the tender must be accepted. The company should seek judicial review and a direction to accept the digitally signed tender.